EUVD-2026-65762
GHSA-w6fp-j497-w2rr
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Remote crafted page needs only a victim visit (UI:R, PR:N, AC:L); sandbox escape justifies scope change (S:C) with full C/I/A impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Out of bounds read in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Out-of-bounds read in Chrome's ANGLE graphics component (Windows builds prior to 152.0.7977.65) lets a remote attacker escape the renderer sandbox and potentially run arbitrary code after a victim opens a crafted HTML page. Google rates the Chromium severity High, and the CVSS is 9.6 driven by the sandbox-escape scope change; there is no public exploit identified at time of analysis and EPSS is low (0.42%).
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to load attacker-controlled HTML in a vulnerable Chrome build (before 152.0.7977.65) on Windows - user interaction is mandatory (UI:R), so the attacker must lure the user to a crafted page rather than trigger it silently. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals conflict in an instructive way. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts or injects a malicious HTML page containing crafted WebGL/graphics content that triggers the out-of-bounds read in ANGLE when rendered. A victim running vulnerable Chrome on Windows visits the page (e.g., via phishing link or malvertising), and the attacker leverages the resulting memory disclosure and corruption to attempt code execution outside the renderer sandbox. … |
| Remediation | Vendor-released patch: update Google Chrome to 152.0.7977.65 or later on Windows via the Stable channel (https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html) and restart the browser, since Chrome updates only take effect after a relaunch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory Chrome deployments on Windows endpoints and assess whether auto-update is enabled; if disabled, prepare deployment tooling. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allShare
External POC / Exploit Code
Leaving vuln.today